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REMARKS 

Claims 1-22 are pending in the application, of which Claims 1 and 12 are independent. 
Claims have been rejected under 35 U.S.C. 1 12, first paragraph, under 35 U.S.C. 1 12, second 
paragraph, under 35 U.S.C. 102(e), and under 35 U.S.C. 103(a). Applicants respectfully traverse 
the rejections and request reconsideration. 

Information Disclosure Statement 

The Office has provided a page of an Information Disclosure Statement (IDS) numbered 
"1 of 1" to Applicants and has noted that the Office believes that the IDS page was included by 
mistake. Applicants agree, and note that the IDS page was likely grouped with Applicants' own 
IDS by USPTO personnel, as the page includes an attorney docket number of "P72562US0," 
which is not the type of number used by Applicant's representatives. Further, the format of the 
page is different from the format used by Applicant's representatives. 

According to section 724.05(111) of the MPEP, "[w]here the Office can determine the 
correct application file that the papers were actually intended for, based on identifying 
information in the heading of the papers (e.g., application number, filing date, title of invention 
and inventor(s) name(s)), the Office will transfer the papers to the correct application file for 
which they were intended without the need of a petition." The page includes an attorney docket 
number, inventor name, and filing date; thus, if the Office can determine from this information 
for which application file the IDS page was intended, the page should be transferred from the 
present application's file to the correct file. Applicants do, however, acknowledge the 
examiner's consideration of the references. 

Suggested Amendments Regarding Functional Claim Language 

The Office has suggested amending the system claims to use the word "programmed" 
instead of "configured" to recite functional language. Clearly, a system programmed to perform 
the recited functions falls within the scope of Applicant's invention. Accordingly, Applicants 
are amending Claims 12, 14, and 17-22 as suggested. 
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Obiection to the Specification 

The specification has been objected to as failing to provide proper antecedent basis for 
the term "kernel events," as recited in independent Claims 1 and 12. The term "kernel events" is 
used because the sensed events are sensed by, and thus, within an operating system kernel {see 
Applicants' specification, page 4, lines 5-17, and page 9, lines 1-6 and 12-17). As such, 
Applicants respectfully request withdrawal of the objection to the specification. 

Rejections Under 35 U.S.C. 1 12, First Paragraph 

Claims 1-22 have been rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply 
with the written description requirement. The Office asserts that the element of "the atomic 
events being low level kernel events, " as previously recited in independent Claims 1 and 12, fails 
to comply with the written description requirement because, according to the Office, the atomic 
events (i) are not disclosed as being kernel events and (ii) are not all low-level events. 

As presented above, the term "kernel events" is used because the sensed atomic events 
are sensed within an operating system kernel. Additionally, Applicants respectfully submit that 
"atomic events" are defined in the specification to be all low-level events, and do not include 
high-level events. The plain meaning of the term "atomic," as used in Applicants' disclosure, 
refers to something that is at its lowest level, or indivisible, like an atom was once thought to be. 
The events called "atomic events" are the lowest-level events and are not divided into multiple 
sub-events. Examples of these low-level events are listed as action types 1-25 in Figs. 4A-B. 
The Office suggests, however, as stated in its rejection under 35 U.S.C. 112, second paragraph, 
that there are conflicting explanations in Applicants' specification regarding "atomic events"; 
namely, that page 6, line 5, and page 11, line 10, conflict. Applicants respectfully disagree that 
the explanations are conflicting. 

Applicants' specification states on page 6, line 5, that "Figs. 4A and 4B are a table of 
possible low level atomic events." The fact that Figs. 4A-B happen to list other types of events 
(high-level action types 26-43), in addition to the low-level events, does not mean that all of the 
listed events should be interpreted as being "low level atomic events," especially in view of the 
fact that action types 1-25 are clearly shown as being low-level events, and that action types 26- 
43 are clearly shown as being high-level events. Applicants' specification further states on page 
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1 1 5 line 10, that "A comprehensive list of typical high level event patterns is shown in Figs. 4 A 
and 4B." Again, the fact that Figs. 4A-B happen to list other types of events (low-level action 
types 1-25), in addition to the high-level events, does not mean that all of the listed events should 
be interpreted as being high-level events. Anyone looking at the "level" column in Figs. 4A and 
4B and seeing some entries labeled as "Low" and other as "High" would also reach the same 
conclusion. The specification even states on page 11, lines 1 1-12, that Figs. 4A and 4B include 
"43 different action types, some of which are low level atomic events and others which are high 
level aggregate events." 

This is also explained on page 12, lines 5-7, of Applicants disclosure, which states that "a 
high level aggregate event (action types 26-42) is determined after seeing a specific sequence of 
lower level events (action types 1-25) " (emphasis added). For example, action type 26 is 
designated as a high-level event and is named "FileEdited." Referring to Fig. 5A, the first row 
shows that a FileEdited event constitutes a certain pattern of low-level events. Those low-level 
events are either FileRead, File Write, or FileReadWrite events {i.e., action types 1-3). 

As such, Applicants respectfully submit that the portions of the specification cited by the 
Office do not conflict, and respectfully request withdrawal of the rejections of Claims 1-22 under 
35 U.S.C. 112, first paragraph. Although Applicants note that the cited portions should already 
not be interpreted to mean that either all events listed in Figs. 4A-B are low-level events or that 
all events are high-level events, Applicants are amending page 6, line 5, of the specification to 
recite that "Figs. 4A and 4B are a table of possible low level atomic events and higher level 
aggregate events," and are amending page 11, line 10, to recite that "A comprehensive list of 
typical low level atomic events and high level event patterns is shown in Figs. 4A and 4B." 

Rejections Under 35 U.S.C. 112, Second Paragraph 

Claims 1-22 have been rejected under 35 U.S.C. 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
Applicant regards as the invention. 

In particular, the Office asserts that Applicants have shown "atomic events" to be both 
low and high level events in Fig. 4A and 4B. The Office further states that the specification does 
not include "a definition with sufficient deliberateness, clarity, and precision to lexicographically 
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define 'atomic events.'" Applicants respectfully note that they are not attempting to 
lexicographically define the term "atomic events." According to section 2111 .01 (IV) of the 
MPEP, an applicant may set forth a definition that is different from its ordinary meaning; but as 
presented above, Applicants use the ordinary term "atomic" to mean, for example, lowest level 
or indivisible. As such, the term "atomic events" should be interpreted to mean low-level events, 
such as the low-level described in Applicants' disclosure. Therefore, Applicants respectfully 
submit that the term "atomic events" is not indefinite. x 

Additionally, the Office asserts that sensing events "from within an operating system 
kernel" is unclear as to whether the sensing occurs in the kernel, or if events from the kernel are 
sensed outside the kernel. As described in Applicants' specification on at least page 4, lines 5- 
17, the sensing of atomic events occurs in the kernel. Further, Claim 12 recites that "the sensor 
[is] located within an operating system kernel." Nevertheless, Applicants are amending 
independent Claims 1 and 12 to remove the word "from"; thus, reciting sensing events "within 
an operating system kernel." Therefore, Applicants respectfully submit that Claims 1 and 12 are 
not indefinite. As such, Applicants respectfully request withdrawal of the rejections of Claims 1- 
22 under 35 U.S.C. 112, second paragraph. 

Rejections Under 35 U.S.C. 102(e) 

Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 have been rejected under 35 U.S.C. 
102(e) as being anticipated by Carter et al (U.S. Pub. No. 2003/0051026, hereinafter "Carter"). 

In their previous response, Applicants submitted that Carter does not teach or suggest that 
atomic events are sensed "within an operating system kernel of a user client device, " as claimed 
in Claims 1 and 12, and provided two reasons: (1) Carter's NSSS does not sense events at an 
end user client device, and (2) the NSSS does not sense events within a kernel of an operating 
system of that device. 

The Office asserts that the events of Carter are sensed at a switch controlled by Carter's 
NSSS {see Carter, reference numeral 18 of Fig. 1). The Office also asserts that a workstation of 
Carter's Fig. 1 discloses the claimed end user client device. Applicants previously submitted that 
if Carter's NSSS senses events at the switch of Fig. 1, then the NSSS does not sense events at a 
workstation of Fig. 1. The Office responded to this on page 15 of the present Office Action by 
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asserting that, as presented in the rejections under 35 U.S.C. 112, second paragraph, the claim 
language of "from within an operating system kernel" was open to alternate interpretations and 
that the Office did not take the interpretation previously argued by Applicants. The possible 
multiple interpretations have been addressed by Applicants' removal of the word "from," as 
presented above; thus, it is respectfully submitted that there should no longer be such an 
alternative interpretation for the Office to reasonably take. 

Furthermore, the Office previously cited paragraph [0147] of Carter as disclosing that the 
sensing step of the NSSS is located within an operating system kernel, but the Office now cites 
paragraph [0810], which states that "[w]henever a user attempts a guarded operation ... the 
kernel relays the attempted operation to the watchdog system." The cited watchdog system is 
used to control access to files (see Carter, paragraph [0797] and [0810]). Access to the files is 
based on a list of permissions and viewing rights (see Carter, paragraph [0809]), not based on an 
aggregation or combination of low-level events, as recited by Claims 1 and 12. Even if Carter's 
watchdog system were interpreted as disclosing the sensing of atomic events within an operating 
system kernel, the system bases its determination to grant a user access to a file based on a single 
event in which the user attempts to access the file. The watchdog system does not disclose 
"aggregating multiple atomic level events to determine a combined event, " as recited by Claim 1 
and as similarly recited by Claim 12. Additionally, the watchdog system does not disclose 
"asserting a policy violation predicate upon an occurrence of a combined event, " as recited by 
Claim 1, or "determining] whether an aggregate event has occurred that violates a predefined 
digital asset usage policy, " as recited by Claim 12. Further, the watchdog system does not 
disclose that any asserting or determining of a policy violation predicate is "implemented in the 
operating system kernel " as recited in dependent Claim 2 and as similarly recited in dependent 
Claim 13. 

Moreover, as previously submitted, Carter suggests that the NSSS is not part of an 
operating system kernel, because Carter discloses that the NSSS has a priority that is higher than 
that of a kernel (see Carter, paragraphs [0588] and [0589]) and that the NSSS may be in 
communication with and pass messages to the kernel (see Carter, paragraphs [0931] and [0936]), 
thus, suggesting that the NSSS and the kernel are separated. This is further supported by the fact 
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that the watchdog system is not part of a kernel, but is only in communication with the kernel 
(see Carter, paragraphs [0810] and [0868]). 

Applicants are also amending Claims 1 and 12 for further clarification. Particularly, the 
independent Claims now recite in more detail that the security perimeter is a "point-of~use 
security perimeter that includes the operating system kernels of two or more data processing 
devices, " as recited in Claim 1 and as similarly recited in Claim 12. Support for the amendments 
can be found in Applicants disclosure on at least page 4, lines 1-13; page 5, lines 26-28; page 13, 
lines 1 1-18; Fig. 1; and lines 5-8 of the Abstract. Cited reference Carter discloses a traditional 
security system, which attempts to prevent access by outside users at a point of network access. 
Rather than establishing a perimeter at external points of access to a network, the claimed 
invention establishes a security perimeter at the points of digital asset use (i.e., within the kernels 
of the user devices). Carter does not disclose this type of perimeter. 

Therefore, Applicants respectfully submit that Claims 1,2, 12, and 13 are novel and 
nonobvious over the cited art. Dependent Claims 3-5, 7, 8, 10, 1 1, 15, 16, 18, 19, 21, and 22 
depend from independent Claims 1 or 12 and include the elements of Claims 1 or 12 presented 
above as being novel and nonobvious over the cited art. Therefore, Applicants respectfully 
submit that these dependent claims are novel and nonobvious over the cited art for at least the 
same reasons as presented above for independent Claims 1 and 12. 

As such, Applicants respectfully request withdrawal of the rejections of Claims 1-5, 7, 8, 
10-13, 15, 16, 18, 19, 21, and 22 under 35 U.S.C. 102(e). 

Rejections Under 35 U.S.C. 103(a) 

Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 have been alternatively rejected under 
35 U.S.C. 103(a) as being unpatentable by Carter in view of Danieli (U.S. Patent No. 6,510,513). 

Claims 6, 17, and 20 have been rejected under 35 U.S.C. 103(a) as being unpatentable 
over Carter in view of Admitted Prior Art. 

Claim 9 has been rejected under 35 U.S.C. 103(a) as being unpatentable over Carter in 
view of Danieli. 

Even if Danieli was combined with Carter for the purpose of teaching the use of a digital 
asset outside of a security perimeter, as explained by the Office, the combination would not cure 
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the deficiencies of Carter presented above with respect to independent Claims 1 and 12. 
Therefore, Applicants respectfully submit that Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, and 22 
are novel and nonobvious over such a combination of Carter and Danieli. As such, Applicants 
respectfully request withdrawal of the rejections of Claims 1-5, 7, 8, 10-13, 15, 16, 18, 19, 21, 
and 22 under 35 U.S.C. 103(a). 

Dependent Claims 6, 9, 17, and 20 depend from independent Claims 1 or 12 and include 
the elements of Claims 1 or 12 presented above as being novel and nonobvious over the cited art. 
Therefore, Applicants respectfully submit that those dependent claims are novel and nonobvious 
over the cited art for at least the same reasons as presented above for independent Claims 1 and 
12. As such, Applicants respectfully request withdrawal of the rejections of Claims 6, 9, 17, and 
20 under 35 U.S.C. 103(a). 



In view of the above amendments and remarks, it is believed that all claims are in 
condition for allowance, and it is respectfully requested that the application be passed to issue. If 
the Examiner feels that a telephone conference would expedite prosecution of this case, the 
Examiner is invited to call the undersigned. 



CONCLUSION 
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